Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!

Notices

Welcome to LinuxQuestions.org, a friendly and active Linux Community.

You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!

Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.

If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.

Having a problem logging in? Please visit this page to clear all LQ-related cookies.

Introduction to Linux - A Hands on Guide

This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.

Hello all,
I have just recently got a server from ServerPronto.com and i am trying to get port forwarding to work. I had this working on a FC4 machine but the new machine is FC10. The error i am getting on the server is this:

open failed: administratively prohibited: firewall policy violation

What i am trying to do is to get squid to proxy for me through this machine. I have squid setup and listening on 3128 and when i connect with the command
ssh -L 3128:ServerIP:3128 user@server
i get logged in and i get that message when i try to connect through it. I have tried numerous ways and it appears to be a problem with the server config. Below is the standard / default sshd_config.

I would appreciate any help you could provide.

# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $

# This is the sshd server system-wide configuration file. See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options change a
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

# Disable legacy (protocol version 1) support in the server for new
# installations. In future the default will change to require explicit
# activation of protocol 1
Protocol 2

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#RhostsRSAAuthentication no
# similar for protocol version 2
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
#UsePAM no
UsePAM yes

sshd should default to listen to port 22. So having "Port 22" commented is the normally the default and should not pose a problem. It's there in the config file in case you want to change it to something else. Sometimes people change it for security reasons so brute force scripts aren't likely to find it.

As root what is the output of

Code:

iptables -nL

Since it kicked out a firewall error, iptables might be blocking that port. You can also issue

Code:

iptables -F

to drop all firewall rules and try again. Just remember to turn your firewall back on as the system might be protecting resources on it that are not configured to protect themselves.

Once you've verified that this is the issue, post back and we can help you modify your firewall to allow ssh connections. You can even limit the number of ssh connections per time. We can help with that too.

I have stopped iptables completely and still no luck. I dont believe it is an issue with the server anymore though. I have taken the same laptop and connected it to another network and the tunneling works fine. It appears that the firewall is somehow blocking this traffic on the outbound path.

I didnt think it was possible but there must be something that is killing the forwarding on the work network.

It appears that the firewall is somehow blocking this traffic on the outbound path.

I'm not sure I fully understand what you are saying. If you tunnel your traffic through ssh, there is no way to know what that traffic is, because it's encrypted. If you can get a command prompt, you can tunnel. Command prompt traffic is no different than any other traffic to a firewall because it is encrypted. Again, I'm not sure I fully understand this statement. Perhaps I am missing something?

Like I say, if you can get a command prompt, there is no reason you can't tunnel anything you want through the tunnel.

The server and client configurations/settings must allow tunneling or port forwarding, but that is ssh configuration, nothing to do with the firewall.